Popeye

Popeye is a read-only linter for live Kubernetes clusters. It inspects resources as they are deployed rather than manifests on disk, and reports misconfigurations, stale or unused resources, and deviations from best practices. It does not modify any cluster resources. If the cluster runs a metric-server, it also reports likely CPU/memory over- or under-allocation and warns when the cluster may run out of capacity.

Linters cover Nodes, Namespaces, Pods, Services, ServiceAccounts, Secrets, ConfigMaps, Deployments, StatefulSets, DaemonSets, PersistentVolumes and Claims, HPAs, PodDisruptionBudgets, RBAC roles and bindings, Ingress, NetworkPolicies, and more. Example checks include port mismatches, containers using untagged or latest images, missing probes or resource requests/limits, unused ConfigMaps, Secrets and ServiceAccounts, node conditions, and utilization above a threshold (default 80% CPU/MEM). Each resource has a short alias such as po, svc, dp or pvc.

It runs against your current kubeconfig context. Use -n for a namespace, -A for all namespaces, --context to pick a context, and -s pod,svc to run specific linters. Linters can be tuned with a "spinach" YAML config passed via -f spinach.yaml. Reports can be rendered in the console, as JSON, or as HTML. Popeye also publishes Prometheus metrics, and the repo includes a sample Grafana dashboard. It is aimed at Kubernetes operators, SREs, and platform engineers auditing cluster health. It runs on Linux, macOS and Windows.

Installation

# via Homebrew
brew install derailed/popeye/popeye

# via Go
go install github.com/derailed/popeye@latest